1

I have enabled SASL_SSL configuraion , And tested with clients producing & consuming data

server.properties

security.inter.broker.protocol=SASL_SSL
sasl.mechanism.inter.broker.protocol=OAUTHBEARER
sasl.enabled.mechanisms=OAUTHBEARER

listeners=PLAINTEXT://localhost:9092,SSL://localhost:9093,SASL_SSL://localhost:9094
advertised.listeners=PLAINTEXT://localhost:9092,SSL://localhost:9093,SASL_SSL://localhost:9094

ssl.keystore.location=c:/kafka/config/kafka.server.keystore.jks
ssl.keystore.password=test1234
ssl.key.password=test1234
ssl.truststore.location=c:/kafka/config/kafka.server.truststore.jks
ssl.truststore.password=test1234

ssl.client.auth=required

consumer.properties

sasl.jaas.config=org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginModule required \
unsecuredLoginStringClaim_sub="alice";

security.protocol=SASL_SSL
sasl.mechanism=OAUTHBEARER

producer.properties

sasl.jaas.config=org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginModule required \
unsecuredLoginStringClaim_sub="alice";

security.protocol=SASL_SSL
sasl.mechanism=OAUTHBEARER

kafka_server_jaas.conf

KafkaServer {
    org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginModule required
    unsecuredLoginStringClaim_sub="admin";
};

how to mention end point to generate the fresh token

  • Please show your relevant config files and errors you're getting, if any – OneCricketeer Oct 01 '20 at 15:57
  • @OneCricketeer I have added those files, actually I am bit confused how it will validate JWT token . If you could help me that will really make my long week into some shorten. –  Oct 01 '20 at 16:14
  • @OneCricketeer how to add any jar so that server.properties could read this value ```listener.name.sasl_plaintext.oauthbearer.sasl.login.callback.handler.class=br.com.jairsjunior.security.oauthbearer.OauthAuthenticateLoginCallbackHandler``` I am refering https://medium.com/@jairsjunior/how-to-setup-oauth2-mechanism-to-a-kafka-broker-e42e72839fe –  Oct 01 '20 at 16:42
  • You can find the classpath variable in the kafka-server-start script or you can put it next to the other Kafka jars – OneCricketeer Oct 01 '20 at 17:18
  • DO I need to make any another server stand by for oAuth request (I mean to generate tokens or refresh tokens etc.,) ? –  Oct 01 '20 at 18:18
  • I don't know how your JAR file works internally, but maybe – OneCricketeer Oct 01 '20 at 20:02
  • @OneCricketeer can you help me in setup for oAuth implementation on local kafka, that would be great or any reference which I can follow –  Oct 02 '20 at 08:45
  • Did SASL_SSL work for you? I have ready to use setup with SASL_PLAINTEXT, but SASL_SSL doesn't work with error A client SSLEngine created with the provided settings can't connect to a server SSLEngine created with those settings. – Hlib Pylypets Feb 14 '23 at 14:15

0 Answers0